CVE-2024-6599
CVE-2024-6599: WordPress Meks Video Importer Plugin API Key Modification Vulnerability. This vulnerability allows authenticated attackers to modify the plugin's API keys due to a missing capability check. Specifically, users with Subscriber-level access and above can exploit the ajax_save_settings function. The Meks Video Importer plugin, versions 1.0.11 and earlier, is affected. Although the SVRS score is 30, indicating a lower risk compared to critical vulnerabilities, the potential for unauthorized API key modification could still lead to data breaches and compromised video imports. Website administrators should update to a patched version of the plugin to mitigate this security risk. The exploit being tagged as "In The Wild" means you should monitor your systems for potential exploitation attempts.
Description:
CVE-2024-6599 affects the Meks Video Importer plugin for WordPress, allowing authenticated attackers with Subscriber-level access or higher to modify the plugin's API keys. This vulnerability stems from a missing capability check on the ajax_save_settings function in versions up to 1.0.11.
Key Insights:
- SVRS Score: 42, indicating a moderate risk.
- Exploit Status: Active exploits have been published.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
- In the Wild: The vulnerability is actively exploited by hackers.
Mitigation Strategies:
- Update the Meks Video Importer plugin to version 1.0.12 or later.
- Restrict access to the plugin's settings page to only authorized users.
- Implement strong password policies and enable two-factor authentication.
- Regularly monitor logs for suspicious activity and take appropriate action.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.